The Landing Page Cat – Coming Soon & Maintenance Pages WordPress plugin versions up to 1.7.2 contain a vulnerability (CVE-2024-0708) that permits unauthenticated attackers to access landing pages that may not be publicly intended. This results in exposure of sensitive information (CWE-200). The CVSS 3.1 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No known exploits are reported in the wild. No patch or vendor advisory is currently provided.

An attacker without authentication can access landing pages that are meant to be private or restricted, potentially exposing sensitive information contained on those pages. There is no indication of impact on integrity or availability. The confidentiality impact is limited but could disclose information that site owners intended to keep private.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should consider restricting access to landing pages via other means such as web server access controls or authentication plugins to prevent unauthorized viewing.